Escape table names in profile image query (Bug #1077013)

When not escaped, the adodb abstraction layer did not use the prefix

Change-Id: Id44f520e2331be7f3e322f2084412d0b3545701c
Signed-off-by: Gregor Anzelj <gregor.anzelj@gmail.com>
Fix mnet jump-back link regression (Bug #1079260)

Was broken by commit 544c62b7964d384713e565b74ca24bd310b126fc for
(Bug #941551)

Change-Id: I5ef546564677927e96541791ca3bbee1869e544b
Add security target for Makefile

It will push a draft patch, and add the security team to the reviewers
list.

Change-Id: Icdc4672abaae327db2066c74ff7b484623de5a4f
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>
Makefile: Add a test for security keywords to securitycheck

Currently checks for cve or security.

Change-Id: I69ae3a2a721bf0179d7b914c8f40f612e71a6204
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>
Makefile: check mergebase of remote not local branch

Change-Id: I62c48bfc55e7bc80dca97a34592d6e8fbd00a465
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>
Check originals directory before iterator in upgrade (Bug #1080498)

If no "original" files had been created via uploads yet, the base
directory was absent, causing the directoryiterator to fail.

Change-Id: I77741f5f8c154a4afdb7b26846dd1aac4356ac72
Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>
Fix the rss image exceptions preventing updating (Bug #1081431)

Check the image data is a string (eg url) or array before
proceeding, and set data to null if not.

Serialising is the only way to check if a value can be unserialised
so @ is suppressing the warnings thrown by non-unserialisable data.

Prevent the issue happening in future installs, and fix current
installs.

Change-Id: I05c88f95e2f511e491bcbd5fa40d3c41949eff7f
Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>
Bug #1079498: Fix XSS in pagination URL

Currently, the url of a pagination (used for the prev/next links as
well as the numbered pages, and also the POST action in the form tag
used for selecting a variable limit, added in the commit listed below)
was not santized on output. This was discovered from the group member
search page which passed in the query as a GET paramter in the URL for
the pages. This uses slightly different code to some of the newer
paginations, but it may affect other places that use similar era
pagination setup.

The commit introducing the new selector for a variable limit was
 f3162f804855a3cdfa560339028da7a29560a491

This patch fixes this by sanitizing the url on output, in both the form
tag and the prev/next and numbered links.

CVE-2012-2253
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>
Change-Id: Id9ed08ef5e61b12580e28f4b18975b2c409b594d
Merge "Fix mnet jump-back link regression (Bug #1079260)" into 1.6_STABLE
Merge "Fix the rss image exceptions preventing updating (Bug #1081431)" into 1.6_STABLE
Merge "Check originals directory before iterator in upgrade (Bug #1080498)" into 1.6_STABLE
Merge "Bug #1079498: Fix XSS in pagination URL" into 1.6_STABLE
Version bump for 1.6.2

Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>
Version bump for 1.6.3testing

Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>
Remove useragent from sso session check (Bug #1082416)

Due to an override for moodle sites in Firefox 17 the useragent
in moodle and mahara cannot match, therefore jumping is broken.
This does not remove the useragent data storage, just the check
when the query for the sessions occurs in transfer and logout.

Change-Id: I59a2e3fb1aea20027ce6cf24338440c866b56f58
Signed-off-by: Melissa Draper <melissa@catalyst.net.nz>
Fix regression in user link display for feedback (Bug #1085569)

In cleanurls commit 0d28fabc9264f2051a4a9829c7730d9d40900ca5 the
item object rather than the author id was passed to the profile_url
method.

Change-Id: I0cf818e57171d63bd07eee372fbacc7accf787ca
Fix pagination double encoding (bug #1089282)

Change-Id: Iee6a362c264eed24dea92ea7b86b9b29fab2e9ee
Signed-off-by: Ruslan Kabalin <r.kabalin@lancaster.ac.uk>
Fix double encoding of &amp; in 'url' for a pagination (Bug #1090203)

Make sure the string '&amp;' does NOT passed to 'url' of a pagination.

All values of 'url' passed to build_pagination were well investigated
and fixed.
All strings of '&amp;' were also well investigated

Change-Id: Id35837459e9dcfc42d2d6133720123e85758aac1
Signed-off-by: Son Nguyen <son.nguyen@catalyst.net.nz>
Merge "Fix regression in user link display for feedback (Bug #1085569)" into 1.6_STABLE